Commit Graph

746 Commits

Author SHA1 Message Date
Curtis Castrapel
d67542d7f5 actually update deps 2018-03-21 12:46:30 -07:00
Curtis Castrapel
4087f1c03b Update auth keys, change python version to satisfy tests 2018-03-21 11:57:19 -07:00
iTitou
bbacb7e210 [fix] No internal server error when trying to Google Auth an unregistered user () 2018-03-21 11:57:19 -07:00
cjwaian
19cf8f6bdd Remove non-ASCII character () 2018-03-21 11:57:19 -07:00
Curtis Castrapel
74a516cde0 nt 2018-03-16 14:15:03 -07:00
Curtis Castrapel
58da68d72f Revert "Requirements and Elasticsearch logging configuration"
This reverts commit c08d3dd82f.
2018-03-16 14:10:12 -07:00
Curtis Castrapel
c7ca3949f6 info level, and new variable name 2018-03-16 11:55:53 -07:00
Curtis Castrapel
bbf5e95186 fix unusued import 2018-03-16 10:07:47 -07:00
Curtis
462e757f92
Merge branch 'master' into requirements_logging 2018-03-16 08:51:25 -07:00
Curtis Castrapel
c08d3dd82f Requirements and Elasticsearch logging configuration 2018-03-16 08:36:10 -07:00
Curtis Castrapel
18c64fafe4 address comment 2018-02-27 12:34:18 -08:00
Curtis Castrapel
77a1600c13 Fix cloned notifications 2018-02-27 10:57:43 -08:00
Curtis Castrapel
5fe28f6503 Description modification 2018-02-26 12:37:31 -08:00
Curtis Castrapel
1f641c0ba6 Description modification 2018-02-26 12:36:40 -08:00
Curtis Castrapel
cca3797669 comments on alembic changes. resolve invalid usage of log_service.create 2018-02-26 12:08:31 -08:00
Curtis Castrapel
a28fdac242 fix pending cert db changes 2018-02-26 09:43:08 -08:00
Curtis
7032abf2e7
Merge branch 'master' into unq-const 2018-02-26 08:03:31 -08:00
Curtis Castrapel
9e8fa5827d unq constraint 2018-02-24 23:15:39 -08:00
Harm Weites
5d18838868 Use Cloudflare as DNS provider for LE certs ()
* Use Cloudflare as DNS provider for LE certs

* Better handle dns_provider plugins
2018-02-22 08:17:28 -08:00
James Chuong
2578970f7d Async Certificate Issuing using Pending Certificates ()
* Add PendingCertificate model

This change creates a DB table called pending_certificates and
associated mapping relationship tables from pending certificate to
roles, rotation policy, destination, sources, etc.

The table is generated on initialization of Lemur. A pending
certificate holds most of the information of a Certificate, while it has
not be issued so that it can later backfill the information when the CA
has issued the certificate.

Change-Id: I277c16b776a71fe5edaf0fa0e76bbedc88924db0
Tickets: PBL-36499

* Create a PendingCertificate if cert is empty

IssuePlugins should return empty cert bodies if the request failed to
complete immediately (such as Digicert).  This way, we can immediately
return the certificate, or if not just place into PendingCertificates
for later processing.

+ Fix relation from Certificate to Pending Certificate, as view only.
There is no real need for anything more than that since Pending cert
only needs to know the cert to replace when it is issued later.

+ Made PendingCertificate private key be empty: UI does not allow
private key on 'Create' but only on 'Import'.  For Instart, we require
the private key but upstream does not necessarily need it.  Thus, if
someone at Instart wants to create a CSR / key combo, they should
manually issue the cert themselves and import later.  Otherwise you
should let Lemur generate that.  This keeps the workflow transparent for
upstream Lemur users.

Change-Id: Ib74722a5ed5792d4b10ca702659422739c95ae26
Tickets: PBL-36343

* Fix empty private_key when create Pending Cert

On creation of a certificate with a CSR, there is no option for private
key.  In this case, we actually have a dictionary with private_key as
key, but the value is None.  This fixes the strip() called on NoneType.

Change-Id: I7b265564d8095bfc83d9d4cd14ae13fea3c03199
Tickets: PBL-36499

* Source sync finds and uses pending certificate

When a source syncs certificates, it will check for a pending
certificate.  If that is found via external_id (given by digicert as
order_id) then it will use the found Pending Certificate's fields to
create a new certificate.  Then the pending certificate is deleted.

Tickets: PBL-36343
Change-Id: I4f7959da29275ebc47a3996741f7e98d3e2d29d9

* Add Lemur static files and views for pending certs

This adds the basic static files to view pending certificates in a
table.

Tickets: PBL-36343
Change-Id: Ia4362e6664ec730d05d280c5ef5c815a6feda0d9

* Add CLI and plugin based pending fetch

This change uses the adds a new function to issuer plugins to fetch
certificates like source, but for one order.  This way, we can control
which pending certificates to try and populate instead of getting all
certificates from source.

Tickets: PBL-36343
Change-Id: Ifc1747ccdc2cba09a81f298b31ddddebfee1b1d6

* Revert source using Pending Certificate

Tickets: PBL-36343
Change-Id: I05121bc951e0530d804070afdb9c9e09baa0bc51

* Fix PendingCertificate init getting authority id

Should get authority id from authority.id instead of the authority_id
key in kwargs.

Change-Id: Ie56df1a5fb0ab2729e91050f3ad1a831853e0623
Tickets: n/a

* Add fixtures and basic test for PendingCertificate

Change-Id: I4cca34105544d40dac1cc50a87bba93d8af9ab34
Tickets: PBL-36343

* Add User to create_certificate parameters

create_certificate now takes a User, which will be used to populate the
'creator' field in certificates.service.upload().  This allows the UI
populate with the current user if the owner does not exist in Lemur.

+ Fix chain being replaced with version from pending certificate, which
may be empty (depends on plugin implementation).

Change-Id: I516027b36bc643c4978b9c4890060569e03f3049
Tickets: n/a

* Fix permalink and filters to pending certs

Fixes the permalink button to get a single pending certificate
Add argument filter parsing for the pending certificate API
Fix comment on API usage
Added get_by_name for pending_certificate (currently unused, but useful
for CLI, instead of using IDs)

Change-Id: Iaa48909c45606bec65dfb193c13d6bd0e816f6db
Tickets: PBL-36910

* Update displayed fields for Pending Certificates

There are a number of unused / unpopulated fields from Certificate UI
that does apply to Pending Certificates.  Those ones were removed, and
added other useful fields:
Owner, number of attempts to fetch and date created

Change-Id: I3010a715f0357ba149cf539a19fdb5974c5ce08b
Tickets: PBL-36910

* Add common name (cn) to Pending Certificate model

Fixes the UI missing the CN for Pending Certificate, as it was
originally being parsed from the generated certificate.  In the case of
pending certificate, the CN from the user generates the request, which
means a pending cert can trust the original user putting in the CN
instead of having to parse the not-yet-generated certificate.  There is
no real possibility to return a certificate from a pending certificate
where the CN has changed since it was initially ordered.

Change-Id: I88a4fa28116d5d8d293e58970d9777ce73fbb2ab
Tickets: PBL-36910

* Fix missing imports for service filter

+ Removed duplicate get_by_name function from old merge

Change-Id: I04ae6852533aa42988433338de74390e2868d69b
Tickets: PBL-36910

* Add private key viewing to Pending Certificates

Add private key API for Pending Certificates, with the same
authorization as Certificates (only owner, creator or owner-roles can
view private key).

Change-Id: Ie5175154a10fe0007cc0e9f35b80c0a01ed48d5b
Tickets: PBL-36910

* Add edit capability to pending certificates

Like editing certificates, we should be able to modify some parts of a
pending certificate so the resulting certificate has the right
references, owner, etc.

+ Added API to update pending certificate
+ Fix UI to use pending certificate scope instead of reusing Certificate
+ Change pending_certificate.replaces to non-passive association, so
that updates do affect it (similar to roles/notifications/etc)

Tickets: PBL-36910
Change-Id: Ibbcb166a33f0337e1b14f426472261222f790ce6

* Add common_name parsing instead using kwargs

To fix tests where common name may not be passed in, use the CSR
generated to find the official common name.

Change-Id: I09f9258fa92c2762d095798676ce210c5d7a3da4
Tickets: PBL-36343

* Add Cancel to pending certificates and plugins

This allows pending certificates to be cancelled, which will be handled
by the issuer plugin.

Change-Id: Ibd6b5627c3977e33aca7860690cfb7f677236ca9
Tickets: PBL-36910

* Add API for Cancelling Pending Certificate

Added the DELETE handler for pending_certificates, which will cancel and
delete the pending certificate from the pending certs table on
successful cancellation via Issuer Plugin.

+ Add UT for testing cancel API

Change-Id: I11b1d87872e4284f6e4f9c366a15da4ddba38bc4
Tickets: PBL-36910

* Remove Export from Pending Certificates

Pending Certificates doesn't need an export since it should just be
fetched by Lemur via plugins, and the CSR is viewable via the UI.

Change-Id: I9a3e65ea11ac5a85316f6428e7f526c3c09178ae
Tickets: PBL-36910

* Add cancel button functionality to UI

This adds the Cancel option to the dropdown of pending certificates.

+ Adds modal window for Note (may not be required for all issuers, just
Digicert)
+ Add schema for cancel input
+ Fix Digitcert plugin for non-existant orders

When an order is actually issued, then attempting to cancel will return
a 403 from Digicert.  This is a case where it should only be done once
we know the pending cert has been sitting for too long.

Change-Id: I256c81ecd142dd51dcf8e38802d2c202829887b0
Tickets: PBL-36910

* Fix test_pending_cancel UT

This change creates and injects a pending cert, which will then be used
for the ID so it can be canceled by the unit test.

Change-Id: I686e7e0fafd68cdaeb26438fb8504d79de77c346
Tickets: PBL-36343

* Fix test_digicert on non-existent order

cancelling a non-existent order is fine since we're cancelling it

Change-Id: I70c0e82ba2f4b8723a7f65b113c19e6eeff7e68c
Tickets: PBL-36343

* Add migrations for PendingCertificates

Added revision for Pending Certificates table and foreign key mapping
tables.

Change-Id: Ife8202cef1e6b99db377851264639ba540b749db
Tickets: n/a

* Fix relationship copy from Pending to Certificate

When a Pending Certificate is changed to a full Certificate, the
relationship fields are not copied via vars() function, as it's not a
column but mapped via association table.  This adds an explicit copy for
these relations.  Which will properly copy them to the new Certificate,
and thus also update destinations.

Change-Id: I322032ce4a9e3e67773f7cf39ee4971054c92685
Tickets: PBL-36343

* Fix renaming of certificates and unit tests

The rename flag was not used to rename certificates on creation as
expected.

Fixed unit test, instead of expunging the session, just copy the
pending_certificate so we don't have a weird reference to the object
that can't be copied via vars() function.

Change-Id: I962943272ed92386ab6eab2af4ed6d074d4cffa0
Tickets: PBL-36343

* Updated developer docs for async certs

Added blurb for implementing new issuer functions.

Change-Id: I1caed6e914bcd73214eae2d241e4784e1b8a0c4c
Tickets: n/a
2018-02-22 08:13:16 -08:00
pincushionman
f44fe81573 fix for https://github.com/Netflix/lemur/issues/1045 () 2018-02-20 08:28:11 -08:00
Curtis
f262c93912 Option to suppress SSL errors () 2018-01-17 09:17:03 -08:00
James Chuong
763c5e8356 Add DIGICERT_ORDER_TYPE to Digicert plugin ()
* Add DIGICERT_ORDER_TYPE to Digicert plugin

This allows lemur.conf.py to control which kind of certificate to
order.  User defined options are not currently supported in the the UI,
so we cannot create multiple Digicert authorities at runtime for
separate certificate types.

Change-Id: I06c216ec3c476e0001b240530626a86464be999e

* Fix Mock URL for Digicert test

Change-Id: Ida7c0ed1bd120c9024bea091c03b7d1ecfa66498

* Add documentation for DIGICERT_ORDER_TYPE

Change-Id: I0bc347883b628416eb7f13a7c60c937dcb6ae0c2
2018-01-13 18:06:17 -08:00
James Chuong
050295ea20 Fix DigiCert issuer plugin revoke URL ()
The URL for revoking DigiCert certificates was incorrect.

Change-Id: I39fb7d290a2a649ab08a47e7dcbe18a8c0bd8a59
2018-01-11 17:12:21 -08:00
kevgliss
eea413a90f
Modifying the way we report metrics. Relying on metric tags instead of the the metric name for additional dimensions. () 2018-01-02 15:26:31 -08:00
kevgliss
8cad2f9f56
Version bump. () 2018-01-02 14:08:56 -08:00
kevgliss
64ac32f683
6.0 release. () 2018-01-02 14:03:38 -08:00
Marti Raudsepp
1287c3dc4a CRL verify: handle "Remove from CRL" status as not revoked ()
Per RFC 5280 section 6.3.3 (k):
https://tools.ietf.org/html/rfc5280#section-6.3.3
2018-01-02 13:39:02 -08:00
Marti Raudsepp
99b10c436a CRL verify: skip unknown URI schemes like ldap:// and add unit tests () 2018-01-02 13:11:17 -08:00
kevgliss
9a0ada75fa
Upgrading satellizer library. () 2018-01-02 09:12:06 -08:00
kevgliss
848ce8c978
Refactoring authentincation to support GET and POST requests. Closes . () 2018-01-01 19:11:29 -08:00
Zach Seils
7b8df16c9e Fix typo in default SSH key path. () 2017-12-20 09:09:56 -08:00
Marti Raudsepp
7a84f38db9 Don't write files from the test suite ()
The lemur_email.tests.test_render test would fail when running unittests
from a read-only source tree.
2017-12-12 10:14:39 -08:00
Marti Raudsepp
ba4de07ad8 Improve certificate details view, make information more concise ()
The "Description" field can now display multi-line text content.

The "Authority" field now displays the authority name in Lemur (if
known) as well as issuer's name. For imported certs, "Imported" is
displayed.
2017-12-12 09:49:30 -08:00
Marti Raudsepp
b2d87940d6 Allow sorting and filtering by camelCase field names ()
The API exposes camelCase field names everywhere, but only accepted
underscore_field_names in 'filter' or 'sort' GET attributes. Now both
are allowed.
2017-12-12 09:44:53 -08:00
Eric
6edc5180c7 fix roles assigned in the ui for sso ()
This commit fixes the ability to assign roles to people in the ui
when the user is SSO. The idea is if a role is ever assigned via
SSO it becomes a "SSO Role" or a "Third Party" Role. by setting
third_party to true on the role object.

Once a role is marked as third party it can no longer be controlled
through the ui for SSO Users. (for ui users this poses no functional
change). It must be controlled via SSO.
2017-12-11 13:51:45 -08:00
Marti Raudsepp
e1f241bd55 Don't send notifications that are marked inactive ()
Apparently previously Lemur ignored the "active" flag of notifications.
2017-12-06 08:32:24 -08:00
kevgliss
ad88637f22
Adding some niceties around the way users are associated with tokens. ()
* Adding some niceties around the way users are associated with tokens.

- Includes user typeahead
- Tooltips
- User information displayed in table
- Default to current user when no user is passed
2017-12-05 10:57:17 -08:00
kevgliss
a756a74b49
Ensures we can get multiple endpoints with the same name but different ports. () 2017-12-04 13:13:02 -08:00
kevgliss
ecc0934657
Adding cli command to clear out pending symantec certificates. () 2017-12-04 10:04:12 -08:00
Eric
c402f1ff87 add per user api keys to the backend ()
Adds in per user api keys to the backend of lemur.
the basics are:
  - API Keys are really just JWTs with custom second length TTLs.
  - API Keys are provided in the exact same ways JWTs are now.
  - API Keys can be revoked/unrevoked at any time by their creator
    as well as have their TTL Change at anytime.
  - Users can create/view/list their own API Keys at will, and
    an admin role has permission to modify all api keys in the
    instance.

Adds in support for lemur api keys to the frontend of lemur.
doing this required a few changes to the backend as well, but it is
now all working (maybe not the best way though, review will determine
that).

  - fixes inconsistency in moduleauthor name I inputted during the
    first commit.
  - Allows the revoke schema to optionally allow a full api_key object.
  - Adds `/users/:user_id/api_keys/:api_key` and `/users/:user_id/api_keys`
    endpoints.
  - normalizes use of `userId` vs `userId`
  - makes `put` call respond with a JWT so the frontend can show
    the token on updating.
  - adds in the API Key views for clicking "API Keys" on the main nav.
  - adds in the API Key views for clicking into a users edit page.
  - adds tests for the API Key backend views I added.
2017-12-04 08:50:31 -08:00
Johannes Langer
5ac3ecb85e Added revoke support to cfssl plugin ()
* Added revoke support to cfssl plugin
2017-11-29 14:33:22 -08:00
kevgliss
c2b2ce1f11
Allowing the export of CAs that don't have a chain. () 2017-11-21 11:42:23 -08:00
kevgliss
cecfe47540
Adding the ability to revoke enmasse () 2017-11-21 09:36:10 -08:00
James Chuong
4b544ae207 CSR Export Plugin ()
This plugin allows a certificate to be exported as a CSR via OpenSSL
x509.  The workflow will be:
* Create self-signed cert via Cryptography authority
* Export CSR via this plugin
* Sign your own cert outside of Lemur
* Import new cert with private key

Change-Id: Id3f7db2506bd959236cd3a6df622841058abda5a
2017-11-14 10:11:06 -08:00
kevgliss
e30e17038b
Removing unused import. () 2017-11-14 09:24:26 -08:00
Daniel Pramann
7e2c16ee38 Fixes for using ACME with Route53 ()
* Changes required for functional Route53 operations

* Changes required for functional ACME operations with Route53

* Changes required for functional ACME operations with Route53, need external ID
2017-11-13 10:19:54 -08:00
Johannes Langer
041f3a22fa Added ability to set custom roles for users logging in via oauth provider () 2017-11-10 08:38:33 -08:00
kevgliss
f990ef27cf Adding sentry tracking to issued with certificate deployment. () 2017-10-26 15:21:13 -07:00
kevgliss
d4209510c2 Adding some additional exception capturing during certificate parsing. () 2017-10-25 08:19:07 -07:00
kevgliss
620e279453 Caa ()
* Adding verisign error code for a CAA failure.

* Tweaking error msg.
2017-10-24 14:46:33 -07:00
kevgliss
bbf73c48a3 Adding health exception tracking. () 2017-10-24 14:04:51 -07:00
Johannes Langer
9319dda0ec Added ability to ignore cert for oauth2 provider ()
* Added ability to ignore cert for oauth2 provider

This is useful for development environments where the OAuth provider
doesn't have a valid cert!

* Setting default for OAUTH2_VERIFY_CERT to true
2017-10-20 16:36:14 -07:00
kevgliss
14f5340802 During higher loads, retrying the connection attempt is often required for the CIS api. () 2017-10-12 10:37:58 -07:00
kevgliss
0152985e64 Adding serial numbers when certificates with the same name are encoun… ()
* Adding serial numbers when certificates with the same name are encountered.
2017-10-11 13:20:19 -07:00
kevgliss
e43268f585 Source plugin ()
* Ensure that None values aren't passed.
2017-10-09 10:37:44 -07:00
kevgliss
7ef788752e Source plugin ()
* Another minor fix.
2017-10-06 17:39:31 -07:00
kevgliss
b66d7ce1fd Source plugin ()
* Ensuring that we have default options for source plugins.

* Handle duplicate serials. Serials are not unique across issuers.

* Minor fix.
2017-10-06 13:22:03 -07:00
kevgliss
dc34652efd Source plugin ()
* Ensuring that we have default options for source plugins.

* Handle duplicate serials. Serials are not unique across issuers.
2017-10-06 08:49:05 -07:00
kevgliss
e0d2fb0de1 Ensuring that we have default options for source plugins. () 2017-10-05 17:27:45 -07:00
kevgliss
e0d9443141 Ensuring existing users are also given the default role. () 2017-10-05 16:47:52 -07:00
kevgliss
a6305a5cae Adding Digicert CIS Sourceplugin ()
* Adding necessary features to complete backfill

* Fixing pagination logic.
2017-10-04 16:56:01 -07:00
kevgliss
9e2578be1e Adding necessary features to complete backfill () 2017-10-04 14:57:57 -07:00
kevgliss
09b8f532a7 Adding cli to mass revoke certificates. () 2017-10-03 10:51:53 -07:00
kevgliss
e0939a2856 Adding some default data to put. () 2017-09-29 14:49:07 -07:00
kevgliss
90f4b458e3 Adding the lemur identity to be able to re-issue certificates. () 2017-09-29 14:07:40 -07:00
kevgliss
f5213deb67 Removing revocation comments for now. () 2017-09-29 10:53:15 -07:00
kevgliss
bb08b1e637 Initial work allowing certificates to be revoked. ()
* Initial work allowing for certificates to be revoked.
2017-09-28 18:27:56 -07:00
Marti Raudsepp
54ff4cddbf Disallow issuing certificates from inactive authority () 2017-09-25 15:34:49 -07:00
Marti Raudsepp
645641f4bd Avoid redundant key_view log entries ()
Don't re-request private key when it's already loaded in frontend.
2017-09-25 15:34:07 -07:00
Marti Raudsepp
97d83890e0 Various minor cleanups and fixes ()
* Documentation fixes

* Various docstring and help string fixes

* Minor code cleanups

* Removed redundant .gitignore entry, ignored package-lock.json.
* 'return' statement in certificates.service.render was redundant
* Split up too long line
* Non-matching tags in templates
2017-09-25 15:33:42 -07:00
Marti Raudsepp
ec5dec4a16 Add option to disable owner email address in CSR subject () 2017-09-25 15:32:08 -07:00
Horatiu Eugen Vlad
f766871824 Create default rotation policy with name () 2017-09-18 09:09:59 -07:00
Rick Breidenstein
fc9b1e5b12 server_default from "False" to sa.false() () 2017-09-11 09:19:19 -07:00
Marti Raudsepp
dafed86179 Improve certificate name normalization: remove Unicode characters, etc. ()
* Accented characters are replaced with non-accented version (ä -> a)
* Spaces are replaced with '-' (previously they were removed)
* Multiple non-alphanumeric characters are collapsed into one '-'
2017-09-08 10:52:22 -07:00
Ian Stahnke
79d12578c7 basic ldap support () 2017-09-03 20:41:43 -07:00
kevgliss
ff87c487c8 It's too expensive to attempt to load all certificates associated with a given notification. Some queries such as default are associated with a large number of certificates. We have little control over when these objects are loaded, but when marshalled they are lazyloaded via SQLAlachemy. If a user needs to get all the certificates associated with a certificate they should use the /notifications/<id>/certificates endpoints that support pagination. () 2017-08-28 17:57:39 -07:00
Marti Raudsepp
82b43b5a9d Create signal hooks and handler for dumping CSR and certificate details () 2017-08-28 17:35:56 -07:00
Marti Raudsepp
bb1c339655 Fix ability to remove all roles from authority () 2017-08-28 17:35:01 -07:00
Marti Raudsepp
e7efaf4365 Prevent creation of empty SubjAltNames extension in CSR () 2017-08-18 09:10:56 -07:00
Marti Raudsepp
c6d76f580e Disable unused Flask Principal sessions ()
Lemur uses its own auth token for authentication; logging out doesn't
properly dispose of the Flask Principal session.
2017-08-17 09:24:35 -07:00
Marti Raudsepp
941df0366d Fix roles display on user screen and fix removing user roles () 2017-08-17 09:24:10 -07:00
Marti Raudsepp
7762d6ed52 Reworked sensitive domain name and restriction logic ()
* This is a fix for a potential security issue; the old code had edge
  cases with unexpected behavior.
* LEMUR_RESTRICTED_DOMAINS is no more, instead LEMUR_WHITELISTED_DOMAINS
  is a list of *allowed* domain name patterns. Per discussion in PR 
* Domain restrictions are now checked everywhere: in domain name-like
  CN (common name) values and SAN DNSNames, including raw CSR requests.
* Common name values that contain a space are exempt, since they cannot
  be valid domain names.
2017-08-16 19:24:49 -07:00
Marti Raudsepp
cf805f530f Prevent unintended access to sensitive fields (passwords, private keys) ()
Make sure that fields specified in filter, sortBy, etc. are model fields
and may be accessed. This is fixes a potential security issue.

The filter() function allowed guessing the content of password hashes
one character at a time.

The sort() function allowed the user to call an arbitrary method of an
arbitrary model attribute, for example sortBy=id&sortDir=distinct would
produce an unexpected error.
2017-08-16 09:38:42 -07:00
Rick Breidenstein
f5e120ad2e Update readme.txt () 2017-08-04 12:42:27 -07:00
kevgliss
f5082e2d3a Starting transition away from not_before and not_after. () 2017-07-14 09:24:59 -07:00
kevgliss
61c493fc91 Adding additional failure conditions to sentry tracking. ()
* Adding additional failure conditions to sentry tracking.

* Removing sentry extension as a circular import.
2017-07-13 14:49:04 -07:00
kevgliss
6779e19ac9 Adding enum migration. () 2017-07-13 13:12:53 -07:00
kevgliss
443eb43d1f Adding the ability to specify a per-certificate rotation policy. () 2017-07-12 16:46:11 -07:00
Paul Van de Vreede
53113e5eeb Add auditing for creating or updating a cert. () 2017-07-04 06:39:16 -07:00
kevgliss
169dcb86e2 supporting the ability to push exceptions to sentry () 2017-06-29 14:12:38 -07:00
Ian Stahnke
e4f5224f42 set ses email content type to utf-8 instead of string () 2017-06-28 09:44:19 -07:00
kevgliss
98907e66e9 Minor fixes to S3.put signature () 2017-06-27 16:18:34 -07:00
kevgliss
c05343d58e Adds the ability for destination plugins to be sub-classed from Expor… ()
* Adds the ability for destination plugins to be sub-classed from ExportDestination. These plugins have the extra option of specifying an export plugin before the destination receives the data. Closes .

* fixing tests
2017-06-26 12:03:24 -07:00
Paul Borg
541fbc9a6d Use named kwargs rather than args when calling s3 put () 2017-06-20 11:28:19 -07:00
Asbjørn Kjær
35cc7ef8d7 Adding support for private DigiCert certificates () 2017-06-14 09:20:24 -07:00
Asbjørn Kjær
e77382864b Fixing KeyError on error handling () 2017-06-14 09:07:27 -07:00
kevgliss
d4d6d832b1 Fixing audit filtering and sorting. () 2017-06-02 09:07:22 -07:00
kevgliss
9c92138f2d Fixing autorotation failures. ()
* Fixing issue with auto rotation failing due to a change in the way certificate data is serialized.
2017-06-02 08:59:42 -07:00
kevgliss
5a4806bc43 Allowing description to be optional. () 2017-06-01 17:09:04 -07:00
kevgliss
07969f7e10 Ensuring IPAddresses and IPNetworks are correctly serialized. () 2017-05-26 10:48:26 -07:00
Michael LoSapio
3141b47fba Catch OAuth providers that want the params sent as data () 2017-05-25 10:21:29 -07:00
kevgliss
21d48b32c9 Fixing an issue with uploading to cloudfront. () 2017-05-25 10:10:12 -07:00
kevgliss
11bd42af82 Correct status code for basic-auth ()
* ensuring those using basic auth recieve a correct status code when their password is incorrect

* Fixing oauth status codes
2017-05-23 09:48:31 -07:00
Paul Borg
f6b5012f56 Add Check of DB connections on healthcheck URL () 2017-05-22 17:15:41 -07:00
kevgliss
f9b388c658 Modifying the was s3 uploading works. ()
* Modiying the was s3 uploading works.

* Fixing pep8
2017-05-20 12:07:44 -07:00
kevgliss
4093f4669a Switching remaining uses of boto to boto3. () 2017-05-20 11:09:55 -07:00
kevgliss
9594f2cd8d Upgrading moto and fixing test that break due to deprecation. ()
* Upgrading moto and fixing test that break due to deprecation.

* Adding region.
2017-05-20 10:40:22 -07:00
kevgliss
380203eb53 Adding the ability to upload to cloudfront via the 'path' parameter. Cloudfront destinations must be created separately. ()
Closes 
2017-05-18 13:49:17 -07:00
kevgliss
307a73c752 Fixing some confusion between 401 vs 403 error code. 401 indicates that the user should attempt to authenticate again. Where as 403 indicates the user is authenticated but not allowed to complete an action. ()
Closes 
2017-05-18 13:20:17 -07:00
kevgliss
3050aca3e6 Minor fixes to the domains UI. ()
* Fixes checkbox input.

* Fixes notification message.
2017-05-15 19:14:12 -07:00
kevgliss
8c41c6785d Fixes issue where domains without any associated certificates are not searchable. () 2017-05-15 19:07:32 -07:00
kevgliss
092ce0f9d8 Closes . () 2017-05-15 19:07:16 -07:00
kevgliss
914de78576 Adds migration to fix keys on unique index. Closes . () 2017-05-10 12:13:42 -07:00
kevgliss
ecf00fe9d6 Splitting out the default date issuance logic for CIS and CC. CIS assumes years is converted to validity_end while CC prefers validity_years over validity_end. () 2017-05-10 12:05:03 -07:00
Michael Treacher
c71b3a319d Log the audit logs () 2017-05-08 09:43:26 -07:00
Michael Treacher
767147aef1 Check for unknown as status is no longer represented as a boolean () 2017-05-08 09:43:19 -07:00
Michael Treacher
ce5a45037a Fix for status representation in the view () 2017-05-05 11:04:40 -07:00
kevgliss
9c9ca37586 Enabling hex serial numbers without breaking backward compatibility. ()
* Enabling hex serial numbers without breaking backward compatibility.

* Fixing tests.
2017-05-05 11:04:09 -07:00
Ian Stahnke
5c41dafc97 fix unit and interval transposition in schemas.py () () 2017-04-30 12:23:34 -07:00
Paul Van de Vreede
989e3733a2 Add docker setup for running tests on a docker enabled dev environment. () 2017-04-28 09:28:06 -07:00
kevgliss
fbc24ea400 There is an issue when iterating over extensions where certificates might not have been issued in adherence with basic constraints. Here we log these errors instead of failing out right. () 2017-04-27 17:45:34 -07:00
kevgliss
4905020e77 ensuring stdout has a default log level () 2017-04-27 10:11:47 -07:00
kevgliss
75787d20bc ensuring that lemur's default user has a valid email () 2017-04-27 09:53:35 -07:00
kevgliss
ca9f120988 fixing some pep8 issues () 2017-04-27 09:44:39 -07:00
Rick Breidenstein
e86954e8ea Destination Plugin/Lemur_linuxdst ()
* Added lemur_linuxdst

* Revert "Added lemur_linuxdst"

This reverts commit 010c19bd1937320189ee5a0660f9e356221121f3.

* added plugin\lemur_linuxdst

Destination plugin for a target linux host

* Update remote_host.py

* Update plugin.py

* Update remote_host.py

* Update plugin.py

* Update plugin.py

* chaning var and funct names

* Write data with local temp

* .

* .

* typo

* tested plugin successfully

* Update plugin.py

* Update remote_host.py

* removed whitespace

* set permissions on exported keys to 600

sftp.chmod(dst_dir_cn + '/' + dst_file, (stat.S_IRUSR))

* Update plugin.py

* Update remote_host.py

* Update plugin.py

* added 'paramiko==2.1.2'

required for lemur_linuxdst plugin

* data stored in clear text at rest

* Update plugin.py

* Update plugin.py

* Update remote_host.py
2017-04-27 09:19:49 -07:00
Paul Van de Vreede
604cd60dbe Return correct intermediate certificate on digicert creation. ()
This commit also removes the unused DIGICERT_INTERMEDIATE env
var as it is not used.
2017-04-27 09:14:20 -07:00
Michael Treacher
05f4ae8e58 Hexify cert serial ()
* Hexify serial at the serialization layer

* Fix for flakey test. Change test to test for uppercased string
2017-04-27 09:13:04 -07:00
kevgliss
88ac783fd2 PEP8 Fixes () 2017-04-25 09:23:18 -07:00
Travis McPeak
bc66ede9aa Fixing Bandit findings and adding travis Bandit job ()
* Fixes for Bandit

This commit fixes a couple of issues so that Bandit can run
cleanly using medium+ severity and confidence filtering.

* Adding Lemur Bandit job to TravisCI
2017-04-24 18:37:03 -07:00
Michael Treacher
1c295896e6 Add test for when there are no notifications on a certificate () 2017-04-24 09:04:49 -07:00
kevgliss
01aa372e59 Version bump. () 2017-04-08 13:23:48 -07:00
kevgliss
81aff42e03 Removing this exception handling, that error should be caught above. () 2017-04-07 16:01:40 -07:00
Michael Treacher
7f019583f2 Don’t set ‘custom_expiration_date’ if validity years is set in the UI. ()
* Don’t set ‘custom_expiration_date’ if validity years is set in the UI.

* Use single quotes instead of double quotes.
2017-04-04 17:11:17 -07:00
kevgliss
f91ae5b319 Fixes bug where authority status was not set correctly. () 2017-03-29 10:10:51 -07:00
kevgliss
f0dde845db Adding ability to exclude certificates from expiration ()
* adding ability to exclude certificates from expiration

* fixing tests
2017-03-15 11:25:19 -07:00
kevgliss
b0ea027769 Underscores should not be in hostnames () 2017-03-15 08:41:06 -07:00
Neil Schelly
8762e1c5ae Issue bugfix ()
* Ensures that both AKI serial/issue _and_ keyid won't be included.
Validation issues crop up if both types of AKI fields are present.

* Ensure that SAN extension includes the certificate's common name

* Fix scenario where subAltNames are getting dropped when applying a template

* Ensure that SAN includes the CN

* Ensuring that getting here without a SAN extension won't break things.

* New cleaner approach

* Some bits of handling the extensions are a bit hacky, requiring access to attributes inside the objects in x509.
I think this is pretty clean though.

* lintian check

* Fixing tests
2017-03-10 09:09:18 -08:00
kevgliss
3c5b2618c0 Rely on the lemur generating the correct name for rotated certificates. ()
* Rely on the lemur generating the correct name for rotated certificates.

* Fixing tests.
2017-03-09 13:09:20 -08:00
kevgliss
602c5580d3 Only validates values if present in options. Fixing authority test to parse plugin information. () 2017-03-06 20:38:04 -08:00
kevgliss
b715687617 Ensuring that we don't fail cleaning if it doesn't exist. () 2017-03-03 16:03:52 -08:00
kevgliss
c46fa5d69c Ensures the rotation has a value during migration. () 2017-03-03 15:16:25 -08:00
kevgliss
310e1d4501 Adds support for filtering by UI. Closes . () 2017-03-03 15:07:26 -08:00
kevgliss
fc957b63ff Source syncing tweaks. ()
* Allow owner to be specified when syncing certs.

* Ensuring non-endpoint plugins don't fail to complete syncing.

* Adding in some additional error handling.
2017-03-03 14:53:56 -08:00
kevgliss
d53f64890c Adding max notification constraint. ()
* Adds additional constraints to the max notification time. With an increasing number of certificates we need to limit the max notification time to reduce the number of certificates that need to be analyzed for notification eligibility.
2017-03-03 12:59:16 -08:00
Neil Schelly
5f5583e2cb UI adjustments for mutually exclusive (radio button version) encipher/decipher-only Key Usage ()
* UI adjustments to make Key Agreement, Encipher Only, and Decipher Only relationship more user-friendly

* whitespace typo

* Issue  switching Encipher/Decipher Only options to be mutually exclusive and un-checkable radio buttons.

* Found a bug in the fields schema that was dropping Key Agreement bit if encipher/decipher only weren't checked
2017-02-16 13:26:56 -08:00
kevgliss
cf6ad94509 Adjusting the way that certificates are requested. ()
* Adjusting the way that certificates are requested.

* Fixing tests.
2017-02-16 13:24:05 -08:00
Gus E
08bb9c73a0 allow attributes to be excluded from a cert subject ()
* allow more flexibility in cert subject name

* clean up logic/remove unnecessary code
2017-02-16 13:21:52 -08:00
Neil Schelly
8e49194764 Issue 688 cert templates ()
* subAltNames were getting wiped out every time a template was selected

* isCritical variables aren't presented in the UI, nor is this information used in determining to use them.
2017-02-10 12:43:41 -08:00
kevgliss
8afcb50a39 Fixing the re-issuance process. Ensuring that certificates that are r… ()
* Fixing the re-issuance process. Ensuring that certificates that are re-issued go through the normal schema validation.

* Fixing tests.
2017-02-03 11:21:53 -08:00